Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2014-4039 (GCVE-0-2014-4039)
Vulnerability from cvelistv5 – Published: 2014-06-17 15:00 – Updated: 2024-08-06 11:04
VLAI?
EPSS
Summary
ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permissions for /tmp/diagSEsnap/snapH.tar.gz, which allows local users to obtain sensitive information by reading files in this archive, as demonstrated by /var/log/messages and /etc/yaboot.conf.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Date Public ?
2014-06-13 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T11:04:27.543Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "RHSA-2015:1320",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1320.html"
},
{
"name": "[oss-security] 20140617 Re: CVE request: multiple /tmp races in ppc64-diag",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2014/06/17/1"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109371"
},
{
"name": "RHSA-2015:0383",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0383.html"
},
{
"name": "60616",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/60616"
},
{
"name": "SUSE-SU-2014:0928",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00018.html"
},
{
"name": "68086",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/68086"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-06-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permissions for /tmp/diagSEsnap/snapH.tar.gz, which allows local users to obtain sensitive information by reading files in this archive, as demonstrated by /var/log/messages and /etc/yaboot.conf."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-01-04T20:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "RHSA-2015:1320",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1320.html"
},
{
"name": "[oss-security] 20140617 Re: CVE request: multiple /tmp races in ppc64-diag",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2014/06/17/1"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109371"
},
{
"name": "RHSA-2015:0383",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0383.html"
},
{
"name": "60616",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/60616"
},
{
"name": "SUSE-SU-2014:0928",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00018.html"
},
{
"name": "68086",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/68086"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-4039",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permissions for /tmp/diagSEsnap/snapH.tar.gz, which allows local users to obtain sensitive information by reading files in this archive, as demonstrated by /var/log/messages and /etc/yaboot.conf."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "RHSA-2015:1320",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1320.html"
},
{
"name": "[oss-security] 20140617 Re: CVE request: multiple /tmp races in ppc64-diag",
"refsource": "MLIST",
"url": "http://openwall.com/lists/oss-security/2014/06/17/1"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1109371",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109371"
},
{
"name": "RHSA-2015:0383",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0383.html"
},
{
"name": "60616",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/60616"
},
{
"name": "SUSE-SU-2014:0928",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00018.html"
},
{
"name": "68086",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/68086"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-4039",
"datePublished": "2014-06-17T15:00:00.000Z",
"dateReserved": "2014-06-12T00:00:00.000Z",
"dateUpdated": "2024-08-06T11:04:27.543Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2014-4039",
"date": "2026-04-24",
"epss": "0.00063",
"percentile": "0.19343"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9BBCD86A-E6C7-4444-9D74-F861084090F0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"51EF4996-72F4-4FA4-814F-F5991E7A8318\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ppc64-diag_project:ppc64-diag:2.6.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EA9A0035-BBB9-4A30-AD10-E911E72178D5\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B072472-B463-4647-885D-E40B0115C810\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permissions for /tmp/diagSEsnap/snapH.tar.gz, which allows local users to obtain sensitive information by reading files in this archive, as demonstrated by /var/log/messages and /etc/yaboot.conf.\"}, {\"lang\": \"es\", \"value\": \"ppc64-diag 2.6.1 utiliza permisos 0775 para /tmp/diagSEsnap y no restringe debidamente permisos para /tmp/diagSEsnap/snapH.tar.gz, lo que permite a usuarios locales obtener informaci\\u00f3n sensible mediante la lectura de ficheros en este archivo, tal y como fue demostrado por /var/log/messages y /etc/yaboot.conf.\"}]",
"id": "CVE-2014-4039",
"lastModified": "2024-11-21T02:09:23.507",
"metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:L/Au:N/C:P/I:N/A:N\", \"baseScore\": 2.1, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 3.9, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2014-06-17T15:55:06.237",
"references": "[{\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00018.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://openwall.com/lists/oss-security/2014/06/17/1\", \"source\": \"cve@mitre.org\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-0383.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-1320.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://secunia.com/advisories/60616\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securityfocus.com/bid/68086\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=1109371\", \"source\": \"cve@mitre.org\", \"tags\": [\"Issue Tracking\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00018.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://openwall.com/lists/oss-security/2014/06/17/1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-0383.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-1320.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://secunia.com/advisories/60616\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/bid/68086\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=1109371\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\"]}]",
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-264\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2014-4039\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2014-06-17T15:55:06.237\",\"lastModified\":\"2025-04-12T10:46:40.837\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permissions for /tmp/diagSEsnap/snapH.tar.gz, which allows local users to obtain sensitive information by reading files in this archive, as demonstrated by /var/log/messages and /etc/yaboot.conf.\"},{\"lang\":\"es\",\"value\":\"ppc64-diag 2.6.1 utiliza permisos 0775 para /tmp/diagSEsnap y no restringe debidamente permisos para /tmp/diagSEsnap/snapH.tar.gz, lo que permite a usuarios locales obtener informaci\u00f3n sensible mediante la lectura de ficheros en este archivo, tal y como fue demostrado por /var/log/messages y /etc/yaboot.conf.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":2.1,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.9,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-264\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9BBCD86A-E6C7-4444-9D74-F861084090F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"51EF4996-72F4-4FA4-814F-F5991E7A8318\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ppc64-diag_project:ppc64-diag:2.6.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EA9A0035-BBB9-4A30-AD10-E911E72178D5\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B072472-B463-4647-885D-E40B0115C810\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00018.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://openwall.com/lists/oss-security/2014/06/17/1\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0383.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1320.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/60616\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/68086\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=1109371\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00018.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://openwall.com/lists/oss-security/2014/06/17/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0383.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1320.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/60616\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/68086\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=1109371\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\"]}]}}"
}
}
RHSA-2015:0383
Vulnerability from csaf_redhat - Published: 2015-03-05 09:06 - Updated: 2025-11-21 17:51Summary
Red Hat Security Advisory: ppc64-diag security, bug fix, and enhancement update
Severity
Moderate
Notes
Topic: Updated ppc64-diag packages that fix two security issues, several bugs, and
add various enhancements are now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details: The ppc64-diag packages provide diagnostic tools for Linux on the 64-bit
PowerPC platforms. The platform diagnostics write events reported by the
firmware to the service log, provide automated responses to urgent events,
and notify system administrators or connected service frameworks about the
reported events.
Multiple insecure temporary file use flaws were found in the way the
ppc64-diag utility created certain temporary files. A local attacker could
possibly use either of these flaws to perform a symbolic link attack and
overwrite arbitrary files with the privileges of the user running
ppc64-diag, or obtain sensitive information from the temporary files.
(CVE-2014-4038, CVE-2014-4039)
The ppc64-diag packages have been upgraded to upstream version 2.6.7, which
provides a number of bug fixes and enhancements over the previous version
including support for hot plugging of QEMU PCI devices. (BZ#1088493,
BZ#1084062)
This update also fixes the following bugs:
* Prior to this update, the rtas_errd daemon was not started by default on
system boot. With this update, rtas_errd has been modified to start
automatically by default. (BZ#1170146)
* Previously, the /var/log/dump file was not automatically created when
installing the ppc64-diag package. This bug has been fixed, and
/var/log/dump is now created at package install time as expected.
(BZ#1175808)
In addition, this update adds the following enhancement:
* This update adds support for building the ppc64-diag packages on the
little-endian variant of IBM Power Systems platform architecture. (BZ#1124007)
Users of ppc64-diag are advised to upgrade to these updated packages, which
correct these issues and add these enhancements.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Multiple insecure temporary file use flaws were found in the way the ppc64-diag utility created certain temporary files. A local attacker could possibly use either of these flaws to perform a symbolic link attack and overwrite arbitrary files with the privileges of the user running ppc64-diag, or obtain sensitive information from the temporary files.
4.6 ()
Vendor Fix
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2015:0383
Multiple insecure temporary file use flaws were found in the way the ppc64-diag utility created certain temporary files. A local attacker could possibly use either of these flaws to perform a symbolic link attack and overwrite arbitrary files with the privileges of the user running ppc64-diag, or obtain sensitive information from the temporary files.
4.6 ()
Vendor Fix
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2015:0383
References
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated ppc64-diag packages that fix two security issues, several bugs, and\nadd various enhancements are now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The ppc64-diag packages provide diagnostic tools for Linux on the 64-bit\nPowerPC platforms. The platform diagnostics write events reported by the\nfirmware to the service log, provide automated responses to urgent events,\nand notify system administrators or connected service frameworks about the\nreported events.\n\nMultiple insecure temporary file use flaws were found in the way the\nppc64-diag utility created certain temporary files. A local attacker could\npossibly use either of these flaws to perform a symbolic link attack and\noverwrite arbitrary files with the privileges of the user running\nppc64-diag, or obtain sensitive information from the temporary files.\n(CVE-2014-4038, CVE-2014-4039)\n\nThe ppc64-diag packages have been upgraded to upstream version 2.6.7, which\nprovides a number of bug fixes and enhancements over the previous version\nincluding support for hot plugging of QEMU PCI devices. (BZ#1088493,\nBZ#1084062)\n\nThis update also fixes the following bugs:\n\n* Prior to this update, the rtas_errd daemon was not started by default on\nsystem boot. With this update, rtas_errd has been modified to start\nautomatically by default. (BZ#1170146)\n\n* Previously, the /var/log/dump file was not automatically created when\ninstalling the ppc64-diag package. This bug has been fixed, and\n/var/log/dump is now created at package install time as expected.\n(BZ#1175808)\n\nIn addition, this update adds the following enhancement:\n\n* This update adds support for building the ppc64-diag packages on the\nlittle-endian variant of IBM Power Systems platform architecture. (BZ#1124007)\n\nUsers of ppc64-diag are advised to upgrade to these updated packages, which\ncorrect these issues and add these enhancements.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:0383",
"url": "https://access.redhat.com/errata/RHSA-2015:0383"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1109371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109371"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0383.json"
}
],
"title": "Red Hat Security Advisory: ppc64-diag security, bug fix, and enhancement update",
"tracking": {
"current_release_date": "2025-11-21T17:51:49+00:00",
"generator": {
"date": "2025-11-21T17:51:49+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2015:0383",
"initial_release_date": "2015-03-05T09:06:12+00:00",
"revision_history": [
{
"date": "2015-03-05T09:06:12+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2015-03-05T09:06:12+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T17:51:49+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::server"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "ppc64-diag-debuginfo-0:2.6.7-6.el7.ppc64",
"product": {
"name": "ppc64-diag-debuginfo-0:2.6.7-6.el7.ppc64",
"product_id": "ppc64-diag-debuginfo-0:2.6.7-6.el7.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ppc64-diag-debuginfo@2.6.7-6.el7?arch=ppc64"
}
}
},
{
"category": "product_version",
"name": "ppc64-diag-0:2.6.7-6.el7.ppc64",
"product": {
"name": "ppc64-diag-0:2.6.7-6.el7.ppc64",
"product_id": "ppc64-diag-0:2.6.7-6.el7.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ppc64-diag@2.6.7-6.el7?arch=ppc64"
}
}
}
],
"category": "architecture",
"name": "ppc64"
},
{
"branches": [
{
"category": "product_version",
"name": "ppc64-diag-0:2.6.7-6.el7.src",
"product": {
"name": "ppc64-diag-0:2.6.7-6.el7.src",
"product_id": "ppc64-diag-0:2.6.7-6.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ppc64-diag@2.6.7-6.el7?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ppc64-diag-0:2.6.7-6.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server:ppc64-diag-0:2.6.7-6.el7.ppc64"
},
"product_reference": "ppc64-diag-0:2.6.7-6.el7.ppc64",
"relates_to_product_reference": "7Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ppc64-diag-0:2.6.7-6.el7.src as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server:ppc64-diag-0:2.6.7-6.el7.src"
},
"product_reference": "ppc64-diag-0:2.6.7-6.el7.src",
"relates_to_product_reference": "7Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ppc64-diag-debuginfo-0:2.6.7-6.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server:ppc64-diag-debuginfo-0:2.6.7-6.el7.ppc64"
},
"product_reference": "ppc64-diag-debuginfo-0:2.6.7-6.el7.ppc64",
"relates_to_product_reference": "7Server"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2014-4038",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2014-06-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1109371"
}
],
"notes": [
{
"category": "description",
"text": "Multiple insecure temporary file use flaws were found in the way the ppc64-diag utility created certain temporary files. A local attacker could possibly use either of these flaws to perform a symbolic link attack and overwrite arbitrary files with the privileges of the user running ppc64-diag, or obtain sensitive information from the temporary files.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ppc64-diag: multiple temporary file races",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server:ppc64-diag-0:2.6.7-6.el7.ppc64",
"7Server:ppc64-diag-0:2.6.7-6.el7.src",
"7Server:ppc64-diag-debuginfo-0:2.6.7-6.el7.ppc64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-4038"
},
{
"category": "external",
"summary": "RHBZ#1109371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-4038",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4038"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-4038",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4038"
}
],
"release_date": "2014-06-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-05T09:06:12+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server:ppc64-diag-0:2.6.7-6.el7.ppc64",
"7Server:ppc64-diag-0:2.6.7-6.el7.src",
"7Server:ppc64-diag-debuginfo-0:2.6.7-6.el7.ppc64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0383"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"7Server:ppc64-diag-0:2.6.7-6.el7.ppc64",
"7Server:ppc64-diag-0:2.6.7-6.el7.src",
"7Server:ppc64-diag-debuginfo-0:2.6.7-6.el7.ppc64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ppc64-diag: multiple temporary file races"
},
{
"cve": "CVE-2014-4039",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2014-06-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1109371"
}
],
"notes": [
{
"category": "description",
"text": "Multiple insecure temporary file use flaws were found in the way the ppc64-diag utility created certain temporary files. A local attacker could possibly use either of these flaws to perform a symbolic link attack and overwrite arbitrary files with the privileges of the user running ppc64-diag, or obtain sensitive information from the temporary files.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ppc64-diag: multiple temporary file races",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server:ppc64-diag-0:2.6.7-6.el7.ppc64",
"7Server:ppc64-diag-0:2.6.7-6.el7.src",
"7Server:ppc64-diag-debuginfo-0:2.6.7-6.el7.ppc64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-4039"
},
{
"category": "external",
"summary": "RHBZ#1109371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-4039",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4039"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-4039",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4039"
}
],
"release_date": "2014-06-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-05T09:06:12+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server:ppc64-diag-0:2.6.7-6.el7.ppc64",
"7Server:ppc64-diag-0:2.6.7-6.el7.src",
"7Server:ppc64-diag-debuginfo-0:2.6.7-6.el7.ppc64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0383"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"7Server:ppc64-diag-0:2.6.7-6.el7.ppc64",
"7Server:ppc64-diag-0:2.6.7-6.el7.src",
"7Server:ppc64-diag-debuginfo-0:2.6.7-6.el7.ppc64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ppc64-diag: multiple temporary file races"
}
]
}
RHSA-2015:1320
Vulnerability from csaf_redhat - Published: 2015-07-20 13:53 - Updated: 2025-11-21 17:52Summary
Red Hat Security Advisory: ppc64-diag security, bug fix and enhancement update
Severity
Moderate
Notes
Topic: Updated ppc64-diag packages that fix two security issues, several bugs, and
add various enhancements are now available for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details: The ppc64-diag packages provide diagnostic tools for Linux on the 64-bit
PowerPC platforms. The platform diagnostics write events reported by the
firmware to the service log, provide automated responses to urgent events,
and notify system administrators or connected service frameworks about the
reported events.
Multiple insecure temporary file use flaws were found in the way the
ppc64-diag utility created certain temporary files. A local attacker could
possibly use either of these flaws to perform a symbolic link attack and
overwrite arbitrary files with the privileges of the user running
ppc64-diag, or obtain sensitive information from the temporary files.
(CVE-2014-4038, CVE-2014-4039)
The ppc64-diag packages have been upgraded to upstream version 2.6.7, which
provides a number of bug fixes and enhancements over the previous version.
(BZ#1148142)
This update also fixes the following bugs:
* Previously, the "explain_syslog" and "syslog_to_svclog" commands failed
with a "No such file or directory" error message. With this update, the
ppc64-diag package specifies the location of the message_catalog directory
correctly, which prevents the described error from occurring. (BZ#1139655)
* Prior to this update, the /var/lock/subsys/rtas_errd file was incorrectly
labeled for SELinux as "system_u:object_r:var_lock_t:s0". This update
corrects the SELinux label to "system_u:object_r:rtas_errd_var_lock_t:s0".
(BZ#1131501)
Users of ppc64-diag are advised to upgrade to these updated packages, which
correct these issues and add these enhancements.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Multiple insecure temporary file use flaws were found in the way the ppc64-diag utility created certain temporary files. A local attacker could possibly use either of these flaws to perform a symbolic link attack and overwrite arbitrary files with the privileges of the user running ppc64-diag, or obtain sensitive information from the temporary files.
4.6 ()
Vendor Fix
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2015:1320
Multiple insecure temporary file use flaws were found in the way the ppc64-diag utility created certain temporary files. A local attacker could possibly use either of these flaws to perform a symbolic link attack and overwrite arbitrary files with the privileges of the user running ppc64-diag, or obtain sensitive information from the temporary files.
4.6 ()
Vendor Fix
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2015:1320
References
| URL | Category | |||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated ppc64-diag packages that fix two security issues, several bugs, and\nadd various enhancements are now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The ppc64-diag packages provide diagnostic tools for Linux on the 64-bit\nPowerPC platforms. The platform diagnostics write events reported by the\nfirmware to the service log, provide automated responses to urgent events,\nand notify system administrators or connected service frameworks about the\nreported events.\n\nMultiple insecure temporary file use flaws were found in the way the\nppc64-diag utility created certain temporary files. A local attacker could\npossibly use either of these flaws to perform a symbolic link attack and\noverwrite arbitrary files with the privileges of the user running\nppc64-diag, or obtain sensitive information from the temporary files.\n(CVE-2014-4038, CVE-2014-4039)\n\nThe ppc64-diag packages have been upgraded to upstream version 2.6.7, which\nprovides a number of bug fixes and enhancements over the previous version.\n(BZ#1148142)\n\nThis update also fixes the following bugs:\n\n* Previously, the \"explain_syslog\" and \"syslog_to_svclog\" commands failed\nwith a \"No such file or directory\" error message. With this update, the\nppc64-diag package specifies the location of the message_catalog directory\ncorrectly, which prevents the described error from occurring. (BZ#1139655)\n\n* Prior to this update, the /var/lock/subsys/rtas_errd file was incorrectly\nlabeled for SELinux as \"system_u:object_r:var_lock_t:s0\". This update\ncorrects the SELinux label to \"system_u:object_r:rtas_errd_var_lock_t:s0\".\n(BZ#1131501)\n\nUsers of ppc64-diag are advised to upgrade to these updated packages, which\ncorrect these issues and add these enhancements.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:1320",
"url": "https://access.redhat.com/errata/RHSA-2015:1320"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1109371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109371"
},
{
"category": "external",
"summary": "1131501",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1131501"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1320.json"
}
],
"title": "Red Hat Security Advisory: ppc64-diag security, bug fix and enhancement update",
"tracking": {
"current_release_date": "2025-11-21T17:52:56+00:00",
"generator": {
"date": "2025-11-21T17:52:56+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2015:1320",
"initial_release_date": "2015-07-20T13:53:17+00:00",
"revision_history": [
{
"date": "2015-07-20T13:53:17+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2015-07-20T13:53:17+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T17:52:56+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::server"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "ppc64-diag-0:2.6.7-4.el6.src",
"product": {
"name": "ppc64-diag-0:2.6.7-4.el6.src",
"product_id": "ppc64-diag-0:2.6.7-4.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ppc64-diag@2.6.7-4.el6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "ppc64-diag-debuginfo-0:2.6.7-4.el6.ppc64",
"product": {
"name": "ppc64-diag-debuginfo-0:2.6.7-4.el6.ppc64",
"product_id": "ppc64-diag-debuginfo-0:2.6.7-4.el6.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ppc64-diag-debuginfo@2.6.7-4.el6?arch=ppc64"
}
}
},
{
"category": "product_version",
"name": "ppc64-diag-0:2.6.7-4.el6.ppc64",
"product": {
"name": "ppc64-diag-0:2.6.7-4.el6.ppc64",
"product_id": "ppc64-diag-0:2.6.7-4.el6.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ppc64-diag@2.6.7-4.el6?arch=ppc64"
}
}
}
],
"category": "architecture",
"name": "ppc64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ppc64-diag-0:2.6.7-4.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server:ppc64-diag-0:2.6.7-4.el6.ppc64"
},
"product_reference": "ppc64-diag-0:2.6.7-4.el6.ppc64",
"relates_to_product_reference": "6Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ppc64-diag-0:2.6.7-4.el6.src as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server:ppc64-diag-0:2.6.7-4.el6.src"
},
"product_reference": "ppc64-diag-0:2.6.7-4.el6.src",
"relates_to_product_reference": "6Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ppc64-diag-debuginfo-0:2.6.7-4.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server:ppc64-diag-debuginfo-0:2.6.7-4.el6.ppc64"
},
"product_reference": "ppc64-diag-debuginfo-0:2.6.7-4.el6.ppc64",
"relates_to_product_reference": "6Server"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2014-4038",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2014-06-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1109371"
}
],
"notes": [
{
"category": "description",
"text": "Multiple insecure temporary file use flaws were found in the way the ppc64-diag utility created certain temporary files. A local attacker could possibly use either of these flaws to perform a symbolic link attack and overwrite arbitrary files with the privileges of the user running ppc64-diag, or obtain sensitive information from the temporary files.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ppc64-diag: multiple temporary file races",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server:ppc64-diag-0:2.6.7-4.el6.ppc64",
"6Server:ppc64-diag-0:2.6.7-4.el6.src",
"6Server:ppc64-diag-debuginfo-0:2.6.7-4.el6.ppc64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-4038"
},
{
"category": "external",
"summary": "RHBZ#1109371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-4038",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4038"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-4038",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4038"
}
],
"release_date": "2014-06-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-07-20T13:53:17+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server:ppc64-diag-0:2.6.7-4.el6.ppc64",
"6Server:ppc64-diag-0:2.6.7-4.el6.src",
"6Server:ppc64-diag-debuginfo-0:2.6.7-4.el6.ppc64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1320"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Server:ppc64-diag-0:2.6.7-4.el6.ppc64",
"6Server:ppc64-diag-0:2.6.7-4.el6.src",
"6Server:ppc64-diag-debuginfo-0:2.6.7-4.el6.ppc64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ppc64-diag: multiple temporary file races"
},
{
"cve": "CVE-2014-4039",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2014-06-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1109371"
}
],
"notes": [
{
"category": "description",
"text": "Multiple insecure temporary file use flaws were found in the way the ppc64-diag utility created certain temporary files. A local attacker could possibly use either of these flaws to perform a symbolic link attack and overwrite arbitrary files with the privileges of the user running ppc64-diag, or obtain sensitive information from the temporary files.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ppc64-diag: multiple temporary file races",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server:ppc64-diag-0:2.6.7-4.el6.ppc64",
"6Server:ppc64-diag-0:2.6.7-4.el6.src",
"6Server:ppc64-diag-debuginfo-0:2.6.7-4.el6.ppc64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-4039"
},
{
"category": "external",
"summary": "RHBZ#1109371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-4039",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4039"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-4039",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4039"
}
],
"release_date": "2014-06-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-07-20T13:53:17+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server:ppc64-diag-0:2.6.7-4.el6.ppc64",
"6Server:ppc64-diag-0:2.6.7-4.el6.src",
"6Server:ppc64-diag-debuginfo-0:2.6.7-4.el6.ppc64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1320"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Server:ppc64-diag-0:2.6.7-4.el6.ppc64",
"6Server:ppc64-diag-0:2.6.7-4.el6.src",
"6Server:ppc64-diag-debuginfo-0:2.6.7-4.el6.ppc64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ppc64-diag: multiple temporary file races"
}
]
}
RHSA-2015_0383
Vulnerability from csaf_redhat - Published: 2015-03-05 09:06 - Updated: 2024-11-22 08:24Summary
Red Hat Security Advisory: ppc64-diag security, bug fix, and enhancement update
Severity
Moderate
Notes
Topic: Updated ppc64-diag packages that fix two security issues, several bugs, and
add various enhancements are now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details: The ppc64-diag packages provide diagnostic tools for Linux on the 64-bit
PowerPC platforms. The platform diagnostics write events reported by the
firmware to the service log, provide automated responses to urgent events,
and notify system administrators or connected service frameworks about the
reported events.
Multiple insecure temporary file use flaws were found in the way the
ppc64-diag utility created certain temporary files. A local attacker could
possibly use either of these flaws to perform a symbolic link attack and
overwrite arbitrary files with the privileges of the user running
ppc64-diag, or obtain sensitive information from the temporary files.
(CVE-2014-4038, CVE-2014-4039)
The ppc64-diag packages have been upgraded to upstream version 2.6.7, which
provides a number of bug fixes and enhancements over the previous version
including support for hot plugging of QEMU PCI devices. (BZ#1088493,
BZ#1084062)
This update also fixes the following bugs:
* Prior to this update, the rtas_errd daemon was not started by default on
system boot. With this update, rtas_errd has been modified to start
automatically by default. (BZ#1170146)
* Previously, the /var/log/dump file was not automatically created when
installing the ppc64-diag package. This bug has been fixed, and
/var/log/dump is now created at package install time as expected.
(BZ#1175808)
In addition, this update adds the following enhancement:
* This update adds support for building the ppc64-diag packages on the
little-endian variant of IBM Power Systems platform architecture. (BZ#1124007)
Users of ppc64-diag are advised to upgrade to these updated packages, which
correct these issues and add these enhancements.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Multiple insecure temporary file use flaws were found in the way the ppc64-diag utility created certain temporary files. A local attacker could possibly use either of these flaws to perform a symbolic link attack and overwrite arbitrary files with the privileges of the user running ppc64-diag, or obtain sensitive information from the temporary files.
4.6 ()
Vendor Fix
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2015:0383
Multiple insecure temporary file use flaws were found in the way the ppc64-diag utility created certain temporary files. A local attacker could possibly use either of these flaws to perform a symbolic link attack and overwrite arbitrary files with the privileges of the user running ppc64-diag, or obtain sensitive information from the temporary files.
4.6 ()
Vendor Fix
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2015:0383
References
| URL | Category | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated ppc64-diag packages that fix two security issues, several bugs, and\nadd various enhancements are now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The ppc64-diag packages provide diagnostic tools for Linux on the 64-bit\nPowerPC platforms. The platform diagnostics write events reported by the\nfirmware to the service log, provide automated responses to urgent events,\nand notify system administrators or connected service frameworks about the\nreported events.\n\nMultiple insecure temporary file use flaws were found in the way the\nppc64-diag utility created certain temporary files. A local attacker could\npossibly use either of these flaws to perform a symbolic link attack and\noverwrite arbitrary files with the privileges of the user running\nppc64-diag, or obtain sensitive information from the temporary files.\n(CVE-2014-4038, CVE-2014-4039)\n\nThe ppc64-diag packages have been upgraded to upstream version 2.6.7, which\nprovides a number of bug fixes and enhancements over the previous version\nincluding support for hot plugging of QEMU PCI devices. (BZ#1088493,\nBZ#1084062)\n\nThis update also fixes the following bugs:\n\n* Prior to this update, the rtas_errd daemon was not started by default on\nsystem boot. With this update, rtas_errd has been modified to start\nautomatically by default. (BZ#1170146)\n\n* Previously, the /var/log/dump file was not automatically created when\ninstalling the ppc64-diag package. This bug has been fixed, and\n/var/log/dump is now created at package install time as expected.\n(BZ#1175808)\n\nIn addition, this update adds the following enhancement:\n\n* This update adds support for building the ppc64-diag packages on the\nlittle-endian variant of IBM Power Systems platform architecture. (BZ#1124007)\n\nUsers of ppc64-diag are advised to upgrade to these updated packages, which\ncorrect these issues and add these enhancements.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:0383",
"url": "https://access.redhat.com/errata/RHSA-2015:0383"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1109371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109371"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0383.json"
}
],
"title": "Red Hat Security Advisory: ppc64-diag security, bug fix, and enhancement update",
"tracking": {
"current_release_date": "2024-11-22T08:24:19+00:00",
"generator": {
"date": "2024-11-22T08:24:19+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2015:0383",
"initial_release_date": "2015-03-05T09:06:12+00:00",
"revision_history": [
{
"date": "2015-03-05T09:06:12+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2015-03-05T09:06:12+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T08:24:19+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::server"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "ppc64-diag-debuginfo-0:2.6.7-6.el7.ppc64",
"product": {
"name": "ppc64-diag-debuginfo-0:2.6.7-6.el7.ppc64",
"product_id": "ppc64-diag-debuginfo-0:2.6.7-6.el7.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ppc64-diag-debuginfo@2.6.7-6.el7?arch=ppc64"
}
}
},
{
"category": "product_version",
"name": "ppc64-diag-0:2.6.7-6.el7.ppc64",
"product": {
"name": "ppc64-diag-0:2.6.7-6.el7.ppc64",
"product_id": "ppc64-diag-0:2.6.7-6.el7.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ppc64-diag@2.6.7-6.el7?arch=ppc64"
}
}
}
],
"category": "architecture",
"name": "ppc64"
},
{
"branches": [
{
"category": "product_version",
"name": "ppc64-diag-0:2.6.7-6.el7.src",
"product": {
"name": "ppc64-diag-0:2.6.7-6.el7.src",
"product_id": "ppc64-diag-0:2.6.7-6.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ppc64-diag@2.6.7-6.el7?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ppc64-diag-0:2.6.7-6.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server:ppc64-diag-0:2.6.7-6.el7.ppc64"
},
"product_reference": "ppc64-diag-0:2.6.7-6.el7.ppc64",
"relates_to_product_reference": "7Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ppc64-diag-0:2.6.7-6.el7.src as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server:ppc64-diag-0:2.6.7-6.el7.src"
},
"product_reference": "ppc64-diag-0:2.6.7-6.el7.src",
"relates_to_product_reference": "7Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ppc64-diag-debuginfo-0:2.6.7-6.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server:ppc64-diag-debuginfo-0:2.6.7-6.el7.ppc64"
},
"product_reference": "ppc64-diag-debuginfo-0:2.6.7-6.el7.ppc64",
"relates_to_product_reference": "7Server"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2014-4038",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2014-06-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1109371"
}
],
"notes": [
{
"category": "description",
"text": "Multiple insecure temporary file use flaws were found in the way the ppc64-diag utility created certain temporary files. A local attacker could possibly use either of these flaws to perform a symbolic link attack and overwrite arbitrary files with the privileges of the user running ppc64-diag, or obtain sensitive information from the temporary files.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ppc64-diag: multiple temporary file races",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server:ppc64-diag-0:2.6.7-6.el7.ppc64",
"7Server:ppc64-diag-0:2.6.7-6.el7.src",
"7Server:ppc64-diag-debuginfo-0:2.6.7-6.el7.ppc64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-4038"
},
{
"category": "external",
"summary": "RHBZ#1109371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-4038",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4038"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-4038",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4038"
}
],
"release_date": "2014-06-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-05T09:06:12+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server:ppc64-diag-0:2.6.7-6.el7.ppc64",
"7Server:ppc64-diag-0:2.6.7-6.el7.src",
"7Server:ppc64-diag-debuginfo-0:2.6.7-6.el7.ppc64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0383"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"7Server:ppc64-diag-0:2.6.7-6.el7.ppc64",
"7Server:ppc64-diag-0:2.6.7-6.el7.src",
"7Server:ppc64-diag-debuginfo-0:2.6.7-6.el7.ppc64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ppc64-diag: multiple temporary file races"
},
{
"cve": "CVE-2014-4039",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2014-06-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1109371"
}
],
"notes": [
{
"category": "description",
"text": "Multiple insecure temporary file use flaws were found in the way the ppc64-diag utility created certain temporary files. A local attacker could possibly use either of these flaws to perform a symbolic link attack and overwrite arbitrary files with the privileges of the user running ppc64-diag, or obtain sensitive information from the temporary files.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ppc64-diag: multiple temporary file races",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server:ppc64-diag-0:2.6.7-6.el7.ppc64",
"7Server:ppc64-diag-0:2.6.7-6.el7.src",
"7Server:ppc64-diag-debuginfo-0:2.6.7-6.el7.ppc64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-4039"
},
{
"category": "external",
"summary": "RHBZ#1109371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-4039",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4039"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-4039",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4039"
}
],
"release_date": "2014-06-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-05T09:06:12+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server:ppc64-diag-0:2.6.7-6.el7.ppc64",
"7Server:ppc64-diag-0:2.6.7-6.el7.src",
"7Server:ppc64-diag-debuginfo-0:2.6.7-6.el7.ppc64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0383"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"7Server:ppc64-diag-0:2.6.7-6.el7.ppc64",
"7Server:ppc64-diag-0:2.6.7-6.el7.src",
"7Server:ppc64-diag-debuginfo-0:2.6.7-6.el7.ppc64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ppc64-diag: multiple temporary file races"
}
]
}
RHSA-2015_1320
Vulnerability from csaf_redhat - Published: 2015-07-20 13:53 - Updated: 2024-11-22 08:24Summary
Red Hat Security Advisory: ppc64-diag security, bug fix and enhancement update
Severity
Moderate
Notes
Topic: Updated ppc64-diag packages that fix two security issues, several bugs, and
add various enhancements are now available for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details: The ppc64-diag packages provide diagnostic tools for Linux on the 64-bit
PowerPC platforms. The platform diagnostics write events reported by the
firmware to the service log, provide automated responses to urgent events,
and notify system administrators or connected service frameworks about the
reported events.
Multiple insecure temporary file use flaws were found in the way the
ppc64-diag utility created certain temporary files. A local attacker could
possibly use either of these flaws to perform a symbolic link attack and
overwrite arbitrary files with the privileges of the user running
ppc64-diag, or obtain sensitive information from the temporary files.
(CVE-2014-4038, CVE-2014-4039)
The ppc64-diag packages have been upgraded to upstream version 2.6.7, which
provides a number of bug fixes and enhancements over the previous version.
(BZ#1148142)
This update also fixes the following bugs:
* Previously, the "explain_syslog" and "syslog_to_svclog" commands failed
with a "No such file or directory" error message. With this update, the
ppc64-diag package specifies the location of the message_catalog directory
correctly, which prevents the described error from occurring. (BZ#1139655)
* Prior to this update, the /var/lock/subsys/rtas_errd file was incorrectly
labeled for SELinux as "system_u:object_r:var_lock_t:s0". This update
corrects the SELinux label to "system_u:object_r:rtas_errd_var_lock_t:s0".
(BZ#1131501)
Users of ppc64-diag are advised to upgrade to these updated packages, which
correct these issues and add these enhancements.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Multiple insecure temporary file use flaws were found in the way the ppc64-diag utility created certain temporary files. A local attacker could possibly use either of these flaws to perform a symbolic link attack and overwrite arbitrary files with the privileges of the user running ppc64-diag, or obtain sensitive information from the temporary files.
4.6 ()
Vendor Fix
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2015:1320
Multiple insecure temporary file use flaws were found in the way the ppc64-diag utility created certain temporary files. A local attacker could possibly use either of these flaws to perform a symbolic link attack and overwrite arbitrary files with the privileges of the user running ppc64-diag, or obtain sensitive information from the temporary files.
4.6 ()
Vendor Fix
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2015:1320
References
| URL | Category | |||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated ppc64-diag packages that fix two security issues, several bugs, and\nadd various enhancements are now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The ppc64-diag packages provide diagnostic tools for Linux on the 64-bit\nPowerPC platforms. The platform diagnostics write events reported by the\nfirmware to the service log, provide automated responses to urgent events,\nand notify system administrators or connected service frameworks about the\nreported events.\n\nMultiple insecure temporary file use flaws were found in the way the\nppc64-diag utility created certain temporary files. A local attacker could\npossibly use either of these flaws to perform a symbolic link attack and\noverwrite arbitrary files with the privileges of the user running\nppc64-diag, or obtain sensitive information from the temporary files.\n(CVE-2014-4038, CVE-2014-4039)\n\nThe ppc64-diag packages have been upgraded to upstream version 2.6.7, which\nprovides a number of bug fixes and enhancements over the previous version.\n(BZ#1148142)\n\nThis update also fixes the following bugs:\n\n* Previously, the \"explain_syslog\" and \"syslog_to_svclog\" commands failed\nwith a \"No such file or directory\" error message. With this update, the\nppc64-diag package specifies the location of the message_catalog directory\ncorrectly, which prevents the described error from occurring. (BZ#1139655)\n\n* Prior to this update, the /var/lock/subsys/rtas_errd file was incorrectly\nlabeled for SELinux as \"system_u:object_r:var_lock_t:s0\". This update\ncorrects the SELinux label to \"system_u:object_r:rtas_errd_var_lock_t:s0\".\n(BZ#1131501)\n\nUsers of ppc64-diag are advised to upgrade to these updated packages, which\ncorrect these issues and add these enhancements.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:1320",
"url": "https://access.redhat.com/errata/RHSA-2015:1320"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1109371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109371"
},
{
"category": "external",
"summary": "1131501",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1131501"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1320.json"
}
],
"title": "Red Hat Security Advisory: ppc64-diag security, bug fix and enhancement update",
"tracking": {
"current_release_date": "2024-11-22T08:24:14+00:00",
"generator": {
"date": "2024-11-22T08:24:14+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2015:1320",
"initial_release_date": "2015-07-20T13:53:17+00:00",
"revision_history": [
{
"date": "2015-07-20T13:53:17+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2015-07-20T13:53:17+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T08:24:14+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::server"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "ppc64-diag-0:2.6.7-4.el6.src",
"product": {
"name": "ppc64-diag-0:2.6.7-4.el6.src",
"product_id": "ppc64-diag-0:2.6.7-4.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ppc64-diag@2.6.7-4.el6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "ppc64-diag-debuginfo-0:2.6.7-4.el6.ppc64",
"product": {
"name": "ppc64-diag-debuginfo-0:2.6.7-4.el6.ppc64",
"product_id": "ppc64-diag-debuginfo-0:2.6.7-4.el6.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ppc64-diag-debuginfo@2.6.7-4.el6?arch=ppc64"
}
}
},
{
"category": "product_version",
"name": "ppc64-diag-0:2.6.7-4.el6.ppc64",
"product": {
"name": "ppc64-diag-0:2.6.7-4.el6.ppc64",
"product_id": "ppc64-diag-0:2.6.7-4.el6.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ppc64-diag@2.6.7-4.el6?arch=ppc64"
}
}
}
],
"category": "architecture",
"name": "ppc64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ppc64-diag-0:2.6.7-4.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server:ppc64-diag-0:2.6.7-4.el6.ppc64"
},
"product_reference": "ppc64-diag-0:2.6.7-4.el6.ppc64",
"relates_to_product_reference": "6Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ppc64-diag-0:2.6.7-4.el6.src as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server:ppc64-diag-0:2.6.7-4.el6.src"
},
"product_reference": "ppc64-diag-0:2.6.7-4.el6.src",
"relates_to_product_reference": "6Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ppc64-diag-debuginfo-0:2.6.7-4.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server:ppc64-diag-debuginfo-0:2.6.7-4.el6.ppc64"
},
"product_reference": "ppc64-diag-debuginfo-0:2.6.7-4.el6.ppc64",
"relates_to_product_reference": "6Server"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2014-4038",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2014-06-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1109371"
}
],
"notes": [
{
"category": "description",
"text": "Multiple insecure temporary file use flaws were found in the way the ppc64-diag utility created certain temporary files. A local attacker could possibly use either of these flaws to perform a symbolic link attack and overwrite arbitrary files with the privileges of the user running ppc64-diag, or obtain sensitive information from the temporary files.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ppc64-diag: multiple temporary file races",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server:ppc64-diag-0:2.6.7-4.el6.ppc64",
"6Server:ppc64-diag-0:2.6.7-4.el6.src",
"6Server:ppc64-diag-debuginfo-0:2.6.7-4.el6.ppc64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-4038"
},
{
"category": "external",
"summary": "RHBZ#1109371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-4038",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4038"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-4038",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4038"
}
],
"release_date": "2014-06-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-07-20T13:53:17+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server:ppc64-diag-0:2.6.7-4.el6.ppc64",
"6Server:ppc64-diag-0:2.6.7-4.el6.src",
"6Server:ppc64-diag-debuginfo-0:2.6.7-4.el6.ppc64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1320"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Server:ppc64-diag-0:2.6.7-4.el6.ppc64",
"6Server:ppc64-diag-0:2.6.7-4.el6.src",
"6Server:ppc64-diag-debuginfo-0:2.6.7-4.el6.ppc64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ppc64-diag: multiple temporary file races"
},
{
"cve": "CVE-2014-4039",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2014-06-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1109371"
}
],
"notes": [
{
"category": "description",
"text": "Multiple insecure temporary file use flaws were found in the way the ppc64-diag utility created certain temporary files. A local attacker could possibly use either of these flaws to perform a symbolic link attack and overwrite arbitrary files with the privileges of the user running ppc64-diag, or obtain sensitive information from the temporary files.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ppc64-diag: multiple temporary file races",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server:ppc64-diag-0:2.6.7-4.el6.ppc64",
"6Server:ppc64-diag-0:2.6.7-4.el6.src",
"6Server:ppc64-diag-debuginfo-0:2.6.7-4.el6.ppc64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-4039"
},
{
"category": "external",
"summary": "RHBZ#1109371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-4039",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4039"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-4039",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4039"
}
],
"release_date": "2014-06-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-07-20T13:53:17+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server:ppc64-diag-0:2.6.7-4.el6.ppc64",
"6Server:ppc64-diag-0:2.6.7-4.el6.src",
"6Server:ppc64-diag-debuginfo-0:2.6.7-4.el6.ppc64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1320"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Server:ppc64-diag-0:2.6.7-4.el6.ppc64",
"6Server:ppc64-diag-0:2.6.7-4.el6.src",
"6Server:ppc64-diag-debuginfo-0:2.6.7-4.el6.ppc64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ppc64-diag: multiple temporary file races"
}
]
}
BDU:2015-04306
Vulnerability from fstec - Published: 17.06.2014
VLAI Severity ?
Title
Уязвимости операционной системы SUSE Linux Enterprise, позволяющие злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
Description
Множественные уязвимости пакета ppc64-diag операционной системы SUSE Linux Enterprise, эксплуатация которых может привести к нарушению конфиденциальности, целостности и доступности защищаемой информации. Эксплуатация уязвимостей может быть осуществлена локально
Severity ?
Vendor
Novell Inc.
Software Name
SUSE Linux Enterprise
Software Version
Server 11 SP3 (SUSE Linux Enterprise)
Possible Mitigations
Установка обновления в соответствии с инструкцией по безопасности, доступной по адресу: http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00018.html
Reference
http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00018.html
CWE
CWE-59
{
"CVSS 2.0": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"CVSS 3.0": null,
"CVSS 4.0": null,
"remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
"remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
"\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Novell Inc.",
"\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "Server 11 SP3 (SUSE Linux Enterprise)",
"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0435\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443: http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00018.html",
"\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "17.06.2014",
"\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "05.07.2024",
"\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "28.04.2015",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2015-04306",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2014-4038, CVE-2014-4039",
"\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442",
"\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
"\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "SUSE Linux Enterprise",
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b SUSE Linux Enterprise, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
"\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0432\u0435\u0440\u043d\u043e\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435 \u0441\u0441\u044b\u043b\u043a\u0438 \u043f\u0435\u0440\u0435\u0434 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a \u0444\u0430\u0439\u043b\u0443 (CWE-59)",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 ppc64-diag \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b SUSE Linux Enterprise, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044e \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0430 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e",
"\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
"\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
"\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
"\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00018.html",
"\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c",
"\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
"\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-59",
"\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 4,4)"
}
BDU:2015-05947
Vulnerability from fstec - Published: None
VLAI Severity ?
Title
Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
Description
Множественные уязвимости пакета ppc64-diag операционной системы openSUSE, эксплуатация которых может привести к нарушению конфиденциальности, целостности и доступности защищаемой информации. Эксплуатация уязвимостей может быть осуществлена локально
Severity ?
Vendor
Novell Inc.
Software Name
openSUSE
Software Version
13.1 (openSUSE)
Possible Mitigations
Установка обновления в соответствии с инструкцией по безопасности, доступной по адресу: http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00022.html
Reference
http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00022.html
CWE
CWE-59
{
"CVSS 2.0": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"CVSS 3.0": null,
"CVSS 4.0": null,
"remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
"remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
"\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Novell Inc.",
"\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "13.1 (openSUSE)",
"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0435\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443: http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00022.html",
"\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": null,
"\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "28.11.2016",
"\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "28.04.2015",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2015-05947",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2014-4038, CVE-2014-4039",
"\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
"\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
"\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "openSUSE",
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b openSUSE, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
"\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0432\u0435\u0440\u043d\u043e\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435 \u0441\u0441\u044b\u043b\u043a\u0438 \u043f\u0435\u0440\u0435\u0434 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a \u0444\u0430\u0439\u043b\u0443 (CWE-59)",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 ppc64-diag \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b openSUSE, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044e \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0430 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e",
"\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
"\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
"\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
"\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00022.html",
"\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
"\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
"\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-59",
"\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 4,4)"
}
BDU:2015-05948
Vulnerability from fstec - Published: None
VLAI Severity ?
Title
Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
Description
Множественные уязвимости пакета ppc64-diag-debuginfo операционной системы openSUSE, эксплуатация которых может привести к нарушению конфиденциальности, целостности и доступности защищаемой информации. Эксплуатация уязвимостей может быть осуществлена локально
Severity ?
Vendor
Novell Inc.
Software Name
openSUSE
Software Version
13.1 (openSUSE)
Possible Mitigations
Установка обновления в соответствии с инструкцией по безопасности, доступной по адресу: http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00022.html
Reference
http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00022.html
CWE
CWE-59
{
"CVSS 2.0": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"CVSS 3.0": null,
"CVSS 4.0": null,
"remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
"remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
"\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Novell Inc.",
"\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "13.1 (openSUSE)",
"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0435\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443: http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00022.html",
"\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": null,
"\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "28.11.2016",
"\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "28.04.2015",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2015-05948",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2014-4038, CVE-2014-4039",
"\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
"\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
"\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "openSUSE",
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b openSUSE, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
"\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0432\u0435\u0440\u043d\u043e\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435 \u0441\u0441\u044b\u043b\u043a\u0438 \u043f\u0435\u0440\u0435\u0434 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a \u0444\u0430\u0439\u043b\u0443 (CWE-59)",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 ppc64-diag-debuginfo \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b openSUSE, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044e \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0430 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e",
"\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
"\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
"\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
"\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00022.html",
"\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
"\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
"\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-59",
"\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 4,4)"
}
BDU:2015-05949
Vulnerability from fstec - Published: None
VLAI Severity ?
Title
Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
Description
Множественные уязвимости пакета ppc64-diag-debugsource операционной системы openSUSE, эксплуатация которых может привести к нарушению конфиденциальности, целостности и доступности защищаемой информации. Эксплуатация уязвимостей может быть осуществлена локально
Severity ?
Vendor
Novell Inc.
Software Name
openSUSE
Software Version
13.1 (openSUSE)
Possible Mitigations
Установка обновления в соответствии с инструкцией по безопасности, доступной по адресу: http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00022.html
Reference
http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00022.html
CWE
CWE-59
{
"CVSS 2.0": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"CVSS 3.0": null,
"CVSS 4.0": null,
"remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
"remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
"\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Novell Inc.",
"\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "13.1 (openSUSE)",
"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0435\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443: http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00022.html",
"\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": null,
"\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "28.11.2016",
"\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "28.04.2015",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2015-05949",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2014-4038, CVE-2014-4039",
"\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
"\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
"\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "openSUSE",
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b openSUSE, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
"\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0432\u0435\u0440\u043d\u043e\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435 \u0441\u0441\u044b\u043b\u043a\u0438 \u043f\u0435\u0440\u0435\u0434 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a \u0444\u0430\u0439\u043b\u0443 (CWE-59)",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 ppc64-diag-debugsource \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b openSUSE, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044e \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0430 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e",
"\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
"\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
"\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
"\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00022.html",
"\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
"\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
"\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-59",
"\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 4,4)"
}
GSD-2014-4039
Vulnerability from gsd - Updated: 2023-12-13 01:22Details
ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permissions for /tmp/diagSEsnap/snapH.tar.gz, which allows local users to obtain sensitive information by reading files in this archive, as demonstrated by /var/log/messages and /etc/yaboot.conf.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2014-4039",
"description": "ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permissions for /tmp/diagSEsnap/snapH.tar.gz, which allows local users to obtain sensitive information by reading files in this archive, as demonstrated by /var/log/messages and /etc/yaboot.conf.",
"id": "GSD-2014-4039",
"references": [
"https://www.suse.com/security/cve/CVE-2014-4039.html",
"https://access.redhat.com/errata/RHSA-2015:1320",
"https://access.redhat.com/errata/RHSA-2015:0383"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2014-4039"
],
"details": "ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permissions for /tmp/diagSEsnap/snapH.tar.gz, which allows local users to obtain sensitive information by reading files in this archive, as demonstrated by /var/log/messages and /etc/yaboot.conf.",
"id": "GSD-2014-4039",
"modified": "2023-12-13T01:22:45.203175Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-4039",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permissions for /tmp/diagSEsnap/snapH.tar.gz, which allows local users to obtain sensitive information by reading files in this archive, as demonstrated by /var/log/messages and /etc/yaboot.conf."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "RHSA-2015:1320",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1320.html"
},
{
"name": "[oss-security] 20140617 Re: CVE request: multiple /tmp races in ppc64-diag",
"refsource": "MLIST",
"url": "http://openwall.com/lists/oss-security/2014/06/17/1"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1109371",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109371"
},
{
"name": "RHSA-2015:0383",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0383.html"
},
{
"name": "60616",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/60616"
},
{
"name": "SUSE-SU-2014:0928",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00018.html"
},
{
"name": "68086",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/68086"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:ppc64-diag_project:ppc64-diag:2.6.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-4039"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permissions for /tmp/diagSEsnap/snapH.tar.gz, which allows local users to obtain sensitive information by reading files in this archive, as demonstrated by /var/log/messages and /etc/yaboot.conf."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1109371",
"refsource": "CONFIRM",
"tags": [
"Issue Tracking"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109371"
},
{
"name": "[oss-security] 20140617 Re: CVE request: multiple /tmp races in ppc64-diag",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://openwall.com/lists/oss-security/2014/06/17/1"
},
{
"name": "SUSE-SU-2014:0928",
"refsource": "SUSE",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00018.html"
},
{
"name": "RHSA-2015:0383",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0383.html"
},
{
"name": "RHSA-2015:1320",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1320.html"
},
{
"name": "68086",
"refsource": "BID",
"tags": [],
"url": "http://www.securityfocus.com/bid/68086"
},
{
"name": "60616",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/60616"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "LOW",
"userInteractionRequired": false
}
},
"lastModifiedDate": "2017-01-07T03:00Z",
"publishedDate": "2014-06-17T15:55Z"
}
}
}
GHSA-CCG6-GVWM-FGPG
Vulnerability from github – Published: 2022-05-17 03:05 – Updated: 2022-05-17 03:05
VLAI?
Details
ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permissions for /tmp/diagSEsnap/snapH.tar.gz, which allows local users to obtain sensitive information by reading files in this archive, as demonstrated by /var/log/messages and /etc/yaboot.conf.
{
"affected": [],
"aliases": [
"CVE-2014-4039"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-06-17T15:55:00Z",
"severity": "LOW"
},
"details": "ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permissions for /tmp/diagSEsnap/snapH.tar.gz, which allows local users to obtain sensitive information by reading files in this archive, as demonstrated by /var/log/messages and /etc/yaboot.conf.",
"id": "GHSA-ccg6-gvwm-fgpg",
"modified": "2022-05-17T03:05:58Z",
"published": "2022-05-17T03:05:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4039"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109371"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00018.html"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2014/06/17/1"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0383.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1320.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/60616"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/68086"
}
],
"schema_version": "1.4.0",
"severity": []
}
FKIE_CVE-2014-4039
Vulnerability from fkie_nvd - Published: 2014-06-17 15:55 - Updated: 2025-04-12 10:46
Severity ?
Summary
ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permissions for /tmp/diagSEsnap/snapH.tar.gz, which allows local users to obtain sensitive information by reading files in this archive, as demonstrated by /var/log/messages and /etc/yaboot.conf.
References
| URL | Tags | ||
|---|---|---|---|
| cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00018.html | Third Party Advisory | |
| cve@mitre.org | http://openwall.com/lists/oss-security/2014/06/17/1 | Mailing List, Third Party Advisory | |
| cve@mitre.org | http://rhn.redhat.com/errata/RHSA-2015-0383.html | Third Party Advisory | |
| cve@mitre.org | http://rhn.redhat.com/errata/RHSA-2015-1320.html | Third Party Advisory | |
| cve@mitre.org | http://secunia.com/advisories/60616 | ||
| cve@mitre.org | http://www.securityfocus.com/bid/68086 | ||
| cve@mitre.org | https://bugzilla.redhat.com/show_bug.cgi?id=1109371 | Issue Tracking | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00018.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://openwall.com/lists/oss-security/2014/06/17/1 | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2015-0383.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2015-1320.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/60616 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/68086 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://bugzilla.redhat.com/show_bug.cgi?id=1109371 | Issue Tracking |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| redhat | enterprise_linux_server | 6.0 | |
| redhat | enterprise_linux_server | 7.0 | |
| ppc64-diag_project | ppc64-diag | 2.6.1 | |
| suse | linux_enterprise_server | 11 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9BBCD86A-E6C7-4444-9D74-F861084090F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "51EF4996-72F4-4FA4-814F-F5991E7A8318",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ppc64-diag_project:ppc64-diag:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA9A0035-BBB9-4A30-AD10-E911E72178D5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8B072472-B463-4647-885D-E40B0115C810",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permissions for /tmp/diagSEsnap/snapH.tar.gz, which allows local users to obtain sensitive information by reading files in this archive, as demonstrated by /var/log/messages and /etc/yaboot.conf."
},
{
"lang": "es",
"value": "ppc64-diag 2.6.1 utiliza permisos 0775 para /tmp/diagSEsnap y no restringe debidamente permisos para /tmp/diagSEsnap/snapH.tar.gz, lo que permite a usuarios locales obtener informaci\u00f3n sensible mediante la lectura de ficheros en este archivo, tal y como fue demostrado por /var/log/messages y /etc/yaboot.conf."
}
],
"id": "CVE-2014-4039",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-06-17T15:55:06.237",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00018.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://openwall.com/lists/oss-security/2014/06/17/1"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0383.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1320.html"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/60616"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/68086"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109371"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00018.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://openwall.com/lists/oss-security/2014/06/17/1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0383.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1320.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/60616"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/68086"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109371"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…